fix(oidc): guard against zero/negative token expiry in session TTL

[s0up4200]

Summary

• When an OIDC provider returns a token without expires_in (or with an already-past expiry), token.Expiry is the Go zero time, making time.Until() return a large negative duration
• This caused sessions to be stored with an already-expired TTL and cookies with a negative max-age, resulting in an infinite redirect loop on /login after successful authentication with the OIDC provider
• Falls back to a 24h TTL when the computed session TTL is non-positive

Details

The OIDC callback handler used time.Until(token.Expiry) in three places:

1. Cache TTL for the session
2. ExpiresAt field in SessionData
3. Cookie max-age

If the provider omits expires_in from the token response, the oauth2 library leaves Token.Expiry as the zero value (0001-01-01T00:00:00Z). time.Until(zeroTime) produces a massive negative duration, causing:

• The cache item to be stored with an already-past expiration (immediately treated as expired on Get())
• The cookie to have a negative max-age (browser may discard it)

Observed with Authentik as the OIDC provider — after successful authentication, the frontend's /api/auth/oidc/verify call would find no session, triggering a redirect loop.

🤖 Generated with Claude Code